Looking for Healthcare M&A in the UAE? 10 Regulatory Due Diligence Factors You Should Know

M&A Insights - Healthcare

Private healthcare in the UAE continues to attract significant investor interest, driven by a growing population and a sophisticated regulatory environment. Acquisitions in this sector involve specific regulatory considerations that extend beyond the standard corporate M&A framework. This article outlines the key legal and regulatory factors that deal professionals should address during the due diligence phase of a healthcare transaction in the UAE.

1. Jurisdictional Competence: Mapping DHA, DOH, and MOHAP

The healthcare regulatory landscape in the UAE is fragmented by emirate. Identifying the competent authority for each asset is the first step in regulatory due diligence. The Dubai Health Authority (DHA) governs facilities and professionals within the Emirate of Dubai, while the Department of Health – Abu Dhabi (DOH) oversees those in Abu Dhabi. The Ministry of Health and Prevention (MOHAP) holds jurisdiction over the Northern Emirates (Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah, and Fujairah).

For targets with a multi-emirate footprint, practitioners must verify compliance with each regulator's specific standards, as circulars and clinical guidelines can vary significantly between jurisdictions.

2. Facility License Continuity: Share vs. Asset Sale

The structure of the transaction, whether a share purchase or an asset purchase, directly dictates the facility licensing pathway. In a share deal, the facility license remains with the target entity, but most regulators require prior notification or approval for a change in ultimate beneficial ownership (UBO).

In an asset deal, facility licenses are generally not transferable. The buyer must typically apply for a new license for the premises under its own corporate entity. This requires careful sequencing to ensure that the seller’s license is only cancelled once the buyer’s license is ready for issuance, preventing a gap in operational authority.

3. Professional License Mapping and Re-linking

Healthcare professionals (physicians, nurses, and allied health staff) are licensed individually by the relevant regulator and must be "linked" to a specific licensed facility. During due diligence, a full census of clinical staff should be cross-referenced against the regulator's portal to confirm validity, specialty scope, and current status.

If a transaction involves moving staff between entities or emirates, the "transfer" process usually involves a Good Standing Certificate from the current regulator and a formal re-linking or conversion application. Under MOHAP rules, for instance, a professional must have at least three months of practice in the current emirate before a transfer application can be initiated.

4. Health Data Localisation (Federal Law No. 2 of 2019)

Compliance with Federal Law No. 2 of 2019 (the "Health Data Law") is a central consideration for any healthcare deal. Article 13 of the law prohibits the transfer, storage, or processing of UAE Health Data outside of the UAE unless an exception applies.

Diligence should focus on the location of Electronic Medical Record (EMR) servers, cloud backups, and any third-party IT service providers. If a target clinic uses a foreign-hosted SaaS platform for patient management without proper authorisation, this represents a regulatory risk that may require technical remediation prior to or immediately after closing.

Technical Note: Data Retention Requirements
Beyond localization, the Health Data Law and associated emirate-level regulations impose strict retention periods. In Dubai, for example, medical records must generally be retained for a minimum of 25 years from the date of the last patient visit. Buyers must ensure that the target’s IT infrastructure and physical storage protocols meet these long-term obligations.

5. Cross-Border Data Transfers and Resolution 51/2021

While the general rule is localisation, Ministerial Resolution 51/2021 provides ten specific scenarios where health data may be transferred abroad. These include pharmacovigilance, scientific research, and insurance claims administration.

Practitioners should diligence whether the target relies on any of these exceptions and, if so, whether the technical and contractual safeguards required by the Resolution are in place. If the target relies on patient consent for data export, the methodology for obtaining and recording that consent must be scrutinised for compliance with the Health Data Law's standards.

6. Medical Malpractice and Governance

All healthcare facilities in the UAE must maintain valid medical malpractice insurance for their clinical staff. Due diligence should verify that the coverage limits meet the minimums prescribed by the relevant regulator and that there is a clear history of claims or potential notifications.

Furthermore, the appointment of a Medical Director is a regulatory requirement. The designated individual must hold the appropriate clinical licensure and seniority. A vacancy in this role or a lack of qualified clinical governance can lead to the suspension of the facility license.

7. Pharmacy and Controlled Medication Licensing

If the target facility includes an on-site pharmacy or handles controlled medications, additional licensing from MOHAP is required. This involves specific requirements for the storage, dispensing, and disposal of medications.

During due diligence, practitioners should review the target’s narcotics and controlled drug registers. Any discrepancies in these records are viewed with extreme scrutiny by health inspectors and can lead to significant fines or criminal liability for the facility's management.

8. Medical Equipment and Radiation Safety

For facilities offering diagnostic imaging (X-rays, CT scans, MRIs), the licensing of medical equipment is a separate workstream. This includes approvals from the Federal Authority for Nuclear Regulation (FANR) for radiation-emitting devices.

Buyers should verify that all equipment has undergone the required preventative maintenance and calibration, and that the Radiation Safety Officer (RSO) is properly qualified and appointed.

9. Clinical Waste and EHS Compliance

Healthcare facilities generate hazardous clinical waste that must be managed according to strict Environment, Health, and Safety (EHS) standards. Facilities are required to have contracts with authorised waste management entities for the collection and disposal of medical waste.

The absence of valid contracts or evidence of improper disposal can result in the immediate suspension of operations. This is a practical due diligence point that should be verified through physical records and site inspections.

10. Health Insurance (Payer) Contract Portability

The commercial viability of most UAE healthcare assets depends on their inclusion in insurance networks. These contracts are with Third-Party Administrators (TPAs) and insurance companies.

In an asset deal, these contracts are not automatically transferred. The buyer must re-apply for empanelment, which can be a time-consuming process. In a share deal, while the contracts remain with the entity, "change of control" clauses may require prior notification or consent from the payers. Failure to secure these consents can lead to the termination of the network agreement, significantly impacting the revenue of the acquired asset.

Conclusion

Regulatory due diligence in UAE healthcare M&A is a technical exercise that requires a detailed understanding of both federal laws and emirate-specific mandates. The interplay between M&A and private equity considerations and healthcare licensing dictates the overall success of the transaction structure.

Identifying licensing gaps, data localisation issues, and professional linking requirements early in the process allows for effective risk allocation within the Share Purchase Agreement (SPA). If you are considering a healthcare transaction in the UAE and would like to discuss the regulatory landscape, please get in touch with our team at Integriti Law.